Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Configuration for Installation by MDM (Administrator Task)

Instructions to configure the Cortex XDR iOS app by MDM.

Using an MDM solution you can manage and control the installation of the iOS Cortex XDR App across all managed corporate or personally-owned iOS devices.

These instructions are supplied by Palo Alto Networks to assist our customers. Support with third party vendor tools (with the exception of JAMF) is out of the scope of Palo Alto Networks.

  1. Create the iOS App installation package using the Cortex XDR or Cortex XSIAM tenant, and then extract the app link and Distribution ID.

  2. In the iOS MDM, create a mobile device app for Cortex XDR. The app is not publicly visible in the App Store. You must enter the app link that you got from the installation package manually. Searching the App Store won't return any results.

    1. Set a display name, such as Cortex XDR.

    2. Set the short version that you see in the app store.

    3. Set the bundle identifier "com.paloaltonetworks.cortex.ios"

    4. Set the app as Free.

    5. If available, set the distribution method to Install Automatically.

    6. If available, set Automatically Force App Updates if you intend to always keep the app up to date.

    7. If available, set Convert Unmanaged App to Managed.

    8. If available, set Allow Users to Remove The App to False.

  3. Create the managed app configuration:

    1. Download our app configuration spec file Download:

      • App Config Spec File Name: iOSCortexXDR_AppConfigSpec_V1.xml

      • SHA-256: 8f0001398937f0b0ad6eeb72cfd022641557c112bb87e4c466fbffdc2b96c612

    2. There are three options, depending on the MDM provider:

      MDM Provided Solution
      Actions

      The provider allows the app configuration spec file to be uploaded and has a built-in editor for the required fields.

      Upload the App Config Spec File to your MDM solution and follow the instructions to fill in the required fields.

      The provider allows the generated app configuration Plist file to be uploaded.

      The AppConfig Generator is a third party tool which assists in the generation of configuration plist for a mobile app on a device enrolled in an MDM solution.

      1. Go to https://appconfig.jamfresearch.com/generator.

      2. Select Browse and upload the App Config Spec File.

      3. Select Configure, and follow the instructions to fill in the required fields. Submit.

      4. Select Download Plist and pass the generated Plist file in the app configuration tab of newly created mobile app.

      The provider allows the generated app to be entered or pasted into the configuration dictionary.

      The AppConfig Generator is a third party tool which assists in the generation of configuration plist for a mobile app on a device enrolled in an MDM solution.

      1. Go to https://appconfig.jamfresearch.com/generator.

      2. Select Browse and upload the App Config Spec File.

      3. Select Configure, and follow the instructions to fill in the required fields. Submit.

      4. Select Copy Dictionary and paste the generated dictionary in the app configuration tab of newly created mobile app.

These images are given for example only, they may differ from the application you are using.

AppConfigGenerator01.png
AppConfigGenerator02.png
AppConfigGenerator03.png

Configure Network Filtering on Supervised Devices (Administrator Task)

When your organization manages iOS devices, the administrator can set up the Network Shield feature to block network activity for specific URLs. The administrator must configure profiles both at the mobile device management (MDM) side, and at the Cortex XDR or Cortex XSIAM tenant side.

  • At the MDM side, configure a payload configuration profile for network filtering.

    • Note that some MDMs do not support lookup values in the network extension profile. As a workaround, when the username is not included, a UDID will be used as the username (on zero touch registration). When a user manually opens the app for the first time after the initial deployment, and a username has been set for the app in the MDM, that username will be used from the first heartbeat and onwards. For example, a username can be set in the MDM by using lookup values.

  • At the Cortex XDR or Cortex XSIAM tenant side, configure the Block list in the URL filtering section of the malware profile.

Note

We recommend that you configure your environment so that iOS device users cannot remove the Cortex XDR app manually.

Task 1: Configure a payload configuration profile

In your MDM, configure a profile for the managed devices, that includes the payload that enables the Network Shield feature. Configure the following:

  • Enable FilterBrowsers and FilterSockets

  • Set PluginBundleID to the bundle ID of the Cortex XDR agent iOS app: com.paloaltonetworks.cortex.ios

  • Set mdmVendor to your organization’s MDM vendor, for example: JAMF or Workspace1.

  • (Optional, supported only on devices running iOS 17 or higher) Add the distributionID to the payload.

    • When the distributionID is included in the payload, registration is performed in the background when the device user first opens the app, and the user does not need to perform the installation wizard's onboarding procedures.

  • (Optional, supported only on devices running iOS 17 or higher) If your MDM solution allows you to set dynamic values in payloads (by providing a value such as $USERNAME or $EMAIL), you can define a user name that will be used during automatic registration in background.

The following example shows a sample configuration profile with the required payload settings:

Task 2: Configure a network filtering policy and assign it to devices

  1. On your Cortex XDR or Cortex XSIAM tenant, create a new Malware profile, or edit an existing one for iOS devices.

    • Ensure that you set URL filtering, Action Mode to Block.

      • Add malicious URLs to the Block List. You can specify exact URLs, or define a range of URLs using wildcards. For example:

        • Block a specific URL: www.google.com

        • Block all URLs under Google: www.google.com/*

    • Ensure that you set Network and EDR Security Module URL filtering to Enabled.

  2. If the Malware profile is not assigned to a prevention policy rule yet, add it to a new or existing policy rule, and ensure that supervised iOS devices are mapped to the policy rule.

  3. To validate that the network filter is enabled on the device, go to the Cortex XDR app Modules screen on the device. The Network Shield tile should display Controlled by admin.

Actions required when disabling a network filter

To disable the network filter, use your MDM to remove the payload configuration profile that enabled the filter from the supervised iOS device.

Actions required when deleting or reinstalling the Cortex XDR app

Before deleting the Cortex XDR app from a supervised device, use your MDM to remove the payload configuration profile that enabled the filter from the supervised iOS device. This will ensure that all processes related to network filtering are terminated correctly, and ensures seamless reinstallation of the app.

Caution

If you do not delete the network filtering configuration profile before deleting the Cortex XDR app from the device, unexpected behaviors might occur, or network connectivity might be lost. Therefore, best practice is to always remove the configuration profile before deleting or reinstalling the Cortex XDR app.

Configuration for Installation by JAMF (Administrator Task)

  1. Create the iOS App installation package using the Cortex XDR or Cortex XSIAM tenant, and then extract the app link and Distribution ID.

  2. In the iOS JAMF MDM, create a mobile device app for Cortex XDR.

    1. From Device Mobile Device Apps select New, then click Next

    2. Choose App Type App Store app or apps purchased in volume

    3. For Search and Upload, select Enter Manually

    4. Set a display name, such as Cortex XDR 8.4.0

    5. Set the short version that you see in the app store.

    6. Set the bundle identifier "com.paloaltonetworks.cortex.ios"

    7. Set the app as Free.

    8. If available, set the distribution method to Install Automatically.

    9. If available, set Automatically Force App Updates if you intend to always keep the app up to date.

    10. If available, set Convert Unmanaged App to Managed.

    11. If available, set Allow Users to Remove The App to False.

    12. Set the App URL to the App link that was received in the installation package, in Step 1.

  3. Create the managed app configuration:

    1. Download our app configuration spec file Download:

      • App Config Spec File Name: iOSCortexXDR_AppConfigSpec_V1.xml

      • SHA-256: 8f0001398937f0b0ad6eeb72cfd022641557c112bb87e4c466fbffdc2b96c612

    2. Use the AppConfig Generator to generate a mobile device app. The AppConfig Generator is a third party tool that assists in the generation of configuration Plist for a mobile app on a device enrolled in an MDM solution.

      1. Go to https://appconfig.jamfresearch.com/generator.

      2. Select Browse and upload the App Config Spec File.

      3. Select Configure, and follow the instructions to fill in the required fields. Submit.

      4. Select Copy Dictionary and paste the generated dictionary in the app configuration tab of newly created mobile app.

      5. Paste the dictionary in the App Configuration tab of the newly created mobile device app.

  4. Select the scope of app:

    • Add the devices that will receive the app.

    • Save the app settings and wait for the app to be delivered to the managed devices.

These images are given for example only, and they may differ from the application you are using.

MobileDeviceApps01.png
MobileDeviceApps02.png
MobileDeviceApps03.png
MobileDeviceApps04.png
MobileDeviceApps05.png
PreviousAdd an Agent Settings Prevention Profile (Administrator Task)
NextDevice User Tasks

Last updated

Was this helpful?